CVE-2025-15224: libssh key passphrase bypass without agent set

Summary: libcurl libssh backend `CURLOPT_SSH_AUTH_TYPES` doesn't implement `CURLSSH_AUTH_AGENT` flag correctly. Rather if `CURLSSH_AUTH_PUBLICKEY` is set, the implementation acts as if `CURLSSH_AUTH_AGENT` is always implicitly defined, and thus no key passphrase is required for authentication.

#include <curl/curl.h>
int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
    curl_easy_setopt(curl, CURLOPT_URL, "sftp://host.example/");
    curl_easy_setopt(curl, CURLOPT_SSH_AUTH_TYPES, CURLSSH_AUTH_PUBLICKEY); …